2022 CVEs (page 84)
Page 84 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-45290 | Critical | 9.1 | 2022-12-09 | Kbase Doc v1.0 was discovered to contain an arbitrary file deletion vulnerability via the component /web/IndexController.java. |
CVE-2022-41299 | Medium | 4.4 | 2022-12-09 | IBM Cloud Transformation Advisor 2.0.1 through 3.3.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code… |
CVE-2022-4336 | Medium | 5.4 | 2022-12-09 | In BAOTA linux panel there exists a stored xss vulnerability attackers can use to obtain sensitive information via the log analysis feature. |
CVE-2022-4170 | Critical | 9.8 | 2022-12-09 | The rxvt-unicode package is vulnerable to a remote code execution, in the Perl background extension, when an attacker can control the data written to the user'… |
CVE-2022-3724 | Medium | 6.3 | 2022-12-09 | Crash in the USB HID protocol dissector in Wireshark 3.6.0 to 3.6.8 allows denial of service via packet injection or crafted capture file on Windows |
CVE-2022-3259 | High | 7.4 | 2022-12-09 | Openshift 4.9 does not use HTTP Strict Transport Security (HSTS) which may allow man-in-the-middle (MITM) attacks. |
CVE-2022-29839 | Medium | 4.1 | 2022-12-09 | Insufficiently Protected Credentials vulnerability in the remote backups application on Western Digital My Cloud devices that could allow an attacker who has g… |
CVE-2022-29838 | Medium | 4.3 | 2022-12-09 | Improper Authentication vulnerability in the encrypted volumes and auto mount features of Western Digital My Cloud devices allows insecure direct access to the… |
CVE-2022-25630 | Medium | 5.4 | 2022-12-09 | An authenticated user can embed malicious content with XSS into the admin group policy page. |
CVE-2022-25629 | Medium | 5.4 | 2022-12-09 | An authenticated user who has the privilege to add/edit annotations on the Content tab, can craft a malicious annotation that can be executed on the annotation… |
CVE-2022-23493 | Critical | 9.1 | 2022-12-09 | xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out… |
CVE-2022-23484 | High | 8.2 | 2022-12-09 | xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Inte… |
CVE-2022-23483 | High | 7.5 | 2022-12-09 | xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out… |
CVE-2022-23482 | Unrated | | 2022-12-09 | xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out… |
CVE-2022-23481 | Unrated | | 2022-12-09 | xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out… |
CVE-2022-23480 | Critical | 9.1 | 2022-12-09 | xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a buff… |
CVE-2022-23479 | Critical | 9.1 | 2022-12-09 | xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a buff… |
CVE-2022-23478 | Critical | 9.1 | 2022-12-09 | xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out… |
CVE-2022-23477 | Critical | 9.1 | 2022-12-09 | xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a buff… |
CVE-2022-23468 | Medium | 6.5 | 2022-12-09 | xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a buff… |
CVE-2022-44838 | High | 7.2 | 2022-12-09 | Automotive Shop Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /services/view_service.php. |
CVE-2022-4264 | Medium | 6.5 | 2022-12-09 | Incorrect Privilege Assignment in M-Files Web (Classic) in M-Files before 22.8.11691.0 allows low privilege user to change some configuration. |
CVE-2022-44213 | Medium | 4.8 | 2022-12-09 | ZKTeco Xiamen Information Technology ZKBio ECO ADMS <=3.1-164 is vulnerable to Cross Site Scripting (XSS). |
CVE-2022-2752 | Medium | 5.5 | 2022-12-09 | A vulnerability in the web server of Secomea GateManager allows a local user to impersonate as the previous user under some failed login conditions. This issu… |
CVE-2022-4377 | Low | 3.5 | 2022-12-09 | A vulnerability was found in S-CMS 5.0 Build 20220328. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the c… |
CVE-2022-4375 | Medium | 6.3 | 2022-12-09 | A vulnerability was found in Mingsoft MCMS up to 5.2.9. It has been classified as critical. Affected is an unknown function of the file /cms/category/list. The… |
CVE-2022-33187 | Medium | 5.5 | 2022-12-09 | Brocade SANnav before v2.2.1 logs usernames and encoded passwords in debug-enabled logs. The vulnerability could allow an attacker with admin privilege to re… |
CVE-2022-38765 | Medium | 6.5 | 2022-12-09 | Canon Medical Informatics Vitrea Vision 7.7.76.1 does not adequately enforce access controls. An authenticated user is able to gain unauthorized access to imag… |
CVE-2022-41948 | Medium | 6.7 | 2022-12-08 | DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. Affected versions are subject to a privilege… |
CVE-2022-41947 | Medium | 5.4 | 2022-12-08 | DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. Through various features of DHIS2, an authen… |
CVE-2022-46158 | Medium | 5.3 | 2022-12-08 | PrestaShop is an open-source e-commerce solution. Versions prior to 1.7.8.8 did not properly restrict host filesystem access for users. Users may have been abl… |
CVE-2022-46153 | High | 8.1 | 2022-12-08 | Traefik is an open source HTTP reverse proxy and load balancer. In affected versions there is a potential vulnerability in Traefik managing TLS connections. A… |
CVE-2022-41949 | Medium | 5.0 | 2022-12-08 | DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. In affected versions an authenticated DHIS2… |
CVE-2022-33186 | Critical | 9.8 | 2022-12-08 | A vulnerability in Brocade Fabric OS software v9.1.1, v9.0.1e, v8.2.3c, v7.4.2j, and earlier versions could allow a remote unauthenticated attacker to execute… |
CVE-2022-23496 | High | 7.5 | 2022-12-08 | Yet Another UserAgent Analyzer (Yauaa) is a java library that tries to parse and analyze the useragent string and extract as many relevant attributes as possi… |
CVE-2022-23495 | High | 7.5 | 2022-12-08 | go-merkledag implements the 'DAGService' interface and adds two ipld node types, Protobuf and Raw for the ipfs project. A `ProtoNode` may be modified in such a… |
CVE-2022-23494 | Medium | 5.4 | 2022-12-08 | tinymce is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in the alert and confirm dialogs when these dialogs were… |
CVE-2022-23469 | Low | 3.5 | 2022-12-08 | Traefik is an open source HTTP reverse proxy and load balancer. Versions prior to 2.9.6 are subject to a potential vulnerability in Traefik displaying the Auth… |
CVE-2022-44938 | Critical | 9.8 | 2022-12-08 | Weak reset token generation in SeedDMS v6.0.20 and v5.1.7 allows attackers to execute a full account takeover via a brute force attack. |
CVE-2022-41717 | Medium | 5.3 | 2022-12-08 | An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by t… |
CVE-2022-4366 | High | 7.5 | 2022-12-08 | Missing Authorization in GitHub repository lirantal/daloradius prior to master branch. |
CVE-2022-46831 | Medium | 6.6 | 2022-12-08 | In JetBrains TeamCity between 2022.10 and 2022.10.1 connecting to AWS using the "Default Credential Provider Chain" allowed TeamCity project administrators to… |
CVE-2022-46830 | Medium | 4.1 | 2022-12-08 | In JetBrains TeamCity between 2022.10 and 2022.10.1 a custom STS endpoint allowed internal port scanning. |
CVE-2022-46829 | High | 7.1 | 2022-12-08 | In JetBrains JetBrains Gateway before 2022.3 a client could connect without a valid token if the host consented. |
CVE-2022-46828 | Medium | 5.2 | 2022-12-08 | In JetBrains IntelliJ IDEA before 2022.3 a DYLIB injection on macOS was possible. |
CVE-2022-46827 | Low | 3.9 | 2022-12-08 | In JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was possible. |
CVE-2022-46826 | Medium | 6.2 | 2022-12-08 | In JetBrains IntelliJ IDEA before 2022.3 the built-in web server allowed an arbitrary file to be read by exploiting a path traversal vulnerability. |
CVE-2022-46825 | Medium | 4.0 | 2022-12-08 | In JetBrains IntelliJ IDEA before 2022.3 the built-in web server leaked information about open projects. |
CVE-2022-46824 | Medium | 5.6 | 2022-12-08 | In JetBrains IntelliJ IDEA before 2022.2.4 a buffer overflow in the fsnotifier daemon on macOS was possible. |
CVE-2022-40939 | Medium | 4.9 | 2022-12-08 | In certain Secustation products the administrator account password can be read. This affects V2.5.5.3116-S50-SMA-B20171107A, V2.3.4.1301-M20-TSA-B20150617A, V2… |
CVE-2022-38599 | Medium | 6.5 | 2022-12-08 | Teleport v3.2.2, Teleport v3.5.6-rc6, and Teleport v3.6.3-b2 was discovered to contain an information leak via the /user/get-role-list web interface. |
CVE-2022-4123 | Low | 3.3 | 2022-12-08 | A flaw was found in Buildah. The local path and the lowest subdirectory may be disclosed due to incorrect absolute path traversal, resulting in an impact to co… |
CVE-2022-4122 | Medium | 5.3 | 2022-12-08 | A vulnerability was found in buildah. Incorrect following of symlinks while reading .containerignore and .dockerignore results in information disclosure. |
CVE-2022-45877 | High | 8.3 | 2022-12-08 | OpenHarmony-v3.1.4 and prior versions had an vulnerability. PIN code is transmitted to the peer device in plain text during cross-device authentication, which… |
CVE-2022-45525 | High | 7.5 | 2022-12-08 | Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the downaction parameter at /goform/CertListInfo. |
CVE-2022-45524 | High | 7.5 | 2022-12-08 | Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the opttype parameter at /goform/IPSECsave. |
CVE-2022-45523 | High | 7.5 | 2022-12-08 | Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/L7Im. |
CVE-2022-45522 | High | 7.5 | 2022-12-08 | Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/SafeClientFilter. |
CVE-2022-45521 | High | 7.5 | 2022-12-08 | Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/SafeUrlFilter. |
CVE-2022-45520 | High | 7.5 | 2022-12-08 | Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/qossetting. |
CVE-2022-45519 | High | 7.5 | 2022-12-08 | Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the Go parameter at /goform/SafeMacFilter. |
CVE-2022-45518 | High | 7.5 | 2022-12-08 | Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/SetIpBind. |
CVE-2022-45517 | High | 7.5 | 2022-12-08 | Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/VirtualSer. |
CVE-2022-45516 | High | 7.5 | 2022-12-08 | Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/NatStaticSetting. |
CVE-2022-45515 | High | 7.5 | 2022-12-08 | Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the entries parameter at /goform/addressNat. |
CVE-2022-45514 | High | 7.5 | 2022-12-08 | Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/webExcptypemanFilter. |
CVE-2022-45513 | High | 7.5 | 2022-12-08 | Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/P2pListFilter. |
CVE-2022-45512 | High | 7.5 | 2022-12-08 | Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/SafeEmailFilter. |
CVE-2022-45511 | High | 7.5 | 2022-12-08 | Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the PPPOEPassword parameter at /goform/QuickIndex. |
CVE-2022-45510 | High | 7.5 | 2022-12-08 | Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the mit_ssid_index parameter at /goform/AdvSetWrlsafeset. |
CVE-2022-45509 | High | 7.5 | 2022-12-08 | Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the account parameter at /goform/addUserName. |
CVE-2022-45508 | High | 7.5 | 2022-12-08 | Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the new_account parameter at /goform/editUserName. |
CVE-2022-45507 | High | 7.5 | 2022-12-08 | Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the editNameMit parameter at /goform/editFileName. |
CVE-2022-45506 | Critical | 9.8 | 2022-12-08 | Tenda W30E v1.0.1.25(633) was discovered to contain a command injection vulnerability via the fileNameMit parameter at /goform/delFileName. |
CVE-2022-45505 | High | 7.5 | 2022-12-08 | Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the cmdinput parameter at /goform/exeCommand. |
CVE-2022-45504 | High | 7.5 | 2022-12-08 | An issue in the component tpi_systool_handle(0) (/goform/SysToolRestoreSet) of Tenda W6-S v1.0.0.4(510) allows unauthenticated attackers to arbitrarily reboot… |
CVE-2022-45503 | High | 7.5 | 2022-12-08 | Tenda W6-S v1.0.0.4(510) was discovered to contain a stack overflow via the linkEn parameter at /goform/setAutoPing. |
CVE-2022-45501 | High | 7.5 | 2022-12-08 | Tenda W6-S v1.0.0.4(510) was discovered to contain a stack overflow via the wl_radio parameter at /goform/wifiSSIDset. |
CVE-2022-45499 | High | 7.5 | 2022-12-08 | Tenda W6-S v1.0.0.4(510) was discovered to contain a stack overflow via the wl_radio parameter at /goform/WifiMacFilterGet. |
CVE-2022-45498 | High | 7.5 | 2022-12-08 | An issue in the component tpi_systool_handle(0) (/goform/SysToolReboot) of Tenda W6-S v1.0.0.4(510) allows unauthenticated attackers to arbitrarily reboot the… |
CVE-2022-45497 | Critical | 9.8 | 2022-12-08 | Tenda W6-S v1.0.0.4(510) was discovered to contain a command injection vulnerability in the tpi_get_ping_output function at /goform/exeCommand. |
CVE-2022-45118 | Medium | 6.2 | 2022-12-08 | OpenHarmony-v3.1.2 and prior versions had a vulnerability that telephony in communication subsystem sends public events with personal data, but the permission… |
CVE-2022-44932 | High | 7.5 | 2022-12-08 | An access control issue in Tenda A18 v15.13.07.09 allows unauthenticated attackers to access the Telnet service. |
CVE-2022-44931 | High | 7.5 | 2022-12-08 | Tenda A18 v15.13.07.09 was discovered to contain a stack overflow via the security_5g parameter at /goform/WifiBasicSet. |
CVE-2022-44455 | Medium | 6.8 | 2022-12-08 | The appspawn and nwebspawn services within OpenHarmony-v3.1.2 and prior versions were found to be vulnerable to buffer overflow vulnerability due to insufficie… |
CVE-2022-41802 | Medium | 4.0 | 2022-12-08 | Kernel subsystem within OpenHarmony-v3.1.4 and prior versions in kernel_liteos_a has a kernel stack overflow vulnerability when call SysClockGetres. 4 bytes pa… |
CVE-2022-3262 | High | 8.1 | 2022-12-08 | A flaw was found in Openshift. A pod with a DNSPolicy of "ClusterFirst" may incorrectly resolve the hostname based on a service provided. This flaw allows an a… |
CVE-2022-3260 | Medium | 4.8 | 2022-12-08 | The response header has not enabled X-FRAME-OPTIONS, Which helps prevents against Clickjacking attack.. Some browsers would interpret these results incorrectly… |
CVE-2022-39915 | Low | 3.3 | 2022-12-08 | Improper access control vulnerability in Calendar prior to versions 11.6.08.0 in Android Q(10), 12.2.11.3000 in Android R(11), 12.3.07.2000 in Android S(12), a… |
CVE-2022-39914 | Medium | 4.0 | 2022-12-08 | Exposure of Sensitive Information from an Unauthorized Actor vulnerability in Samsung DisplayManagerService prior to Android T(13) allows local attacker to acc… |
CVE-2022-39913 | Medium | 6.8 | 2022-12-08 | Exposure of Sensitive Information to an Unauthorized Actor in Persona Manager prior to Android T(13) allows local attacker to access user profiles information. |
CVE-2022-39912 | Medium | 6.2 | 2022-12-08 | Improper handling of insufficient permissions vulnerability in setSecureFolderPolicy in PersonaManagerService prior to Android T(13) allows local attackers to… |
CVE-2022-39911 | Medium | 4.8 | 2022-12-08 | Improper check or handling of exceptional conditions vulnerability in Samsung Pass prior to version 4.0.06.1 allows attacker to access Samsung Pass. |
CVE-2022-39910 | Low | 3.9 | 2022-12-08 | Improper access control vulnerability in Samsung Pass prior to version 4.0.06.7 allow physical attackers to access data of Samsung Pass on a certain state of a… |
CVE-2022-39909 | High | 7.1 | 2022-12-08 | Insufficient verification of data authenticity vulnerability in Samsung Gear IconX PC Manager prior to version 2.1.221019.51 allows local attackers to create a… |
CVE-2022-39908 | Medium | 6.9 | 2022-12-08 | TOCTOU vulnerability in Samsung decoding library for video thumbnails prior to SMR Dec-2022 Release 1 allows local attacker to perform Out-Of-Bounds Write. |
CVE-2022-39907 | Medium | 6.9 | 2022-12-08 | Integer overflow vulnerability in Samsung decoding library for video thumbnails prior to SMR Dec-2022 Release 1 allows local attacker to perform Out-Of-Bounds… |
CVE-2022-39906 | Low | 2.3 | 2022-12-08 | Improper access control vulnerability in SecTelephonyProvider prior to SMR Dec-2022 Release 1 allows attackers to access message information. |
CVE-2022-39905 | Medium | 4.0 | 2022-12-08 | Implicit intent hijacking vulnerability in Telecom application prior to SMR Dec-2022 Release 1 allows attacker to access sensitive information via implicit int… |
CVE-2022-39904 | Low | 3.3 | 2022-12-08 | Exposure of Sensitive Information vulnerability in Samsung Settings prior to SMR Dec-2022 Release 1 allows local attackers to access the Network Access Identif… |